Sensitive Information Exposure via Log Injection in TanOS

Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2026-2605 is a medium-severity vulnerability in TanOS that involves the insertion of sensitive information into log files.'}, {'type': 'paragraph', 'content': 'Specifically, an attacker with access to TanOS syslog output can obtain the temporary password of a TanOS user whose password was recently reset.'}, {'type': 'paragraph', 'content': "This temporary password is valid only from the time of the reset until the user's first successful login."}] [1]

Useful 0 Not Useful 0

Impact Analysis

An attacker who can access TanOS syslog output can retrieve temporary passwords of users who recently reset their passwords.

This could allow unauthorized access to user accounts during the window between password reset and first login.

Since the vulnerability exposes sensitive authentication information, it increases the risk of account compromise.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the insertion of sensitive information, specifically temporary passwords, into TanOS syslog output. Detection would involve inspecting the TanOS syslog files for the presence of temporary passwords issued after a password reset.

However, no specific detection commands or tools are provided in the available information.

Useful 0 Not Useful 0

Mitigation Strategies

The only effective mitigation is to upgrade TanOS to a fixed version. The fixed versions are Update 21 (v1.8.4.0249) or later for the 2024H2 release, Update 14 (v1.8.5.0282) or later for the 2025H1 release, and Update 5 (v1.8.6.0150) or later for the 2025H2 release.

No workarounds or other mitigations are available.

Useful 0 Not Useful 0